GreyNoise has expanded its telemetry on SSHole (CVE-2026-123158), an OpenSSH authentication-bypass flaw affecting certain musl-based Linux systems. Its tracker, last updated on November 11 at 03:40 UTC, records 26 confirmed post-exploitation activities and five possible exploitation attempts.
It also lists 33.1 million attempted SSH connections since November 5, although those connection totals are not successful-exploitation counts. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on November 9 and set a November 12 remediation deadline for US federal civilian agencies.
The tracker includes intrusions recorded on November 10. One, from an address mapped to Vodafone Data in Egypt, involved 28 shell sessions, 52 commands and 10 files edited between 15:03 and 15:06 UTC. Another, from an address mapped to DIGI SPAIN TELECOM, involved 16 shell sessions, 54 commands and three files edited between 08:29 and 13:35 UTC. GreyNoise groups some of the activity under its GT10 threat cluster, but says the cluster can change as its investigation develops and that not all SSHole activity is attributable to it.
Earlier activity tracked by GreyNoise included an attacker uploading a Python tool called TAC Agent and attempting to register it with a command-and-control server. The enrollment failed, and the tool did not receive a task. Another intrusion used 10 shell sessions and 59 commands to check whether a host was running in a container, query AWS, Azure and Alibaba Cloud metadata services, and attempt to read root’s SSH keys and password hashes in /etc/shadow through doas. GreyNoise says that attacker wrote no files and installed no tools.
SSHole affects OpenSSH versions before 10.6p2 on Linux systems that use the musl C library with PAM disabled. On Alpine systems, the affected configuration also requires password authentication to be enabled, an account with a * password field, and another local account with a $5$ or $6$ password hash. Alpine’s advisory describes the trigger as a 257-to-1,024-byte password. Systems using glibc or PAM-enabled authentication are outside the stated scope of the flaw.
OpenSSH released version 10.6p2 on November 5 as a security workaround for Linux systems using musl without PAM. Alpine lists fixed package revisions for its supported branches, including edge (10.6_p2-r0), 3.24 (10.3_p1-r2), 3.23 (10.2_p1-r1), 3.22 (10.0_p1-r11), 3.21 (9.9_p2-r1), 3.20 (9.7_p1-r6), 3.19 (9.6_p1-r3), 3.18 (9.3_p2-r4), 3.17 (9.1_p1-r7) and 3.16 (9.0_p1-r6). The OpenSSH release notes and Alpine’s security advisory describe the fix, while GreyNoise’s live tracker provides the latest observed activity. CISA’s KEV catalog entry lists the vulnerability as exploited.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
The CISA listing follows the first confirmed exploitation that GreyNoise observed on November 7. It adds to the earlier report of a successful root login on a Previdian honeypot and the initial disclosure of the OpenSSH password-authentication bypass.
